---
title: "Bulk create/update filtering rules"
method: POST
path: "/filtering-rules/bulk"
tags: ["filtering-rules"]
---

# Bulk create/update filtering rules

`POST /filtering-rules/bulk`

Creates or updates multiple filtering rules at once. In "merge" mode (default), rules with IDs are updated and rules without IDs are created. In "overwrite" mode, all existing rules for the given environment are deleted and replaced with the provided rules.

## Headers

- `X-API-Version` string, required

## Request body

- BulkFilteringRulesDtoV2
  - `rules` BulkFilteringRuleItemDto[], required — Array of filtering rules to create or update
    - `name` string, required — Name of the filtering rule
    - `expression` string, required — Expression in expr-lang format that defines the rule condition
    - `action` 'allow' | 'deny', required — Action to take when the rule matches
    - `status` 'enabled' | 'disabled' — Status of the filtering rule
    - `deny_with` 'Forbidden' — Error message to return when denying a request
    - `placement` PlacementDto
      - `position` number — Position index to insert the rule at
      - `after` string — ID of the rule to insert after
      - `before` string — ID of the rule to insert before
  - `mode` 'merge' | 'overwrite' — Mode for bulk operation. "merge" (default) updates existing rules and creates new ones. "overwrite" deletes all existing rules for the environment and creates new ones.
  - `environment` string, required — Environment ID

## Response `200`

List of created/updated filtering rules.

- 76818c770704cb8ff0d6e
  - `data` FilteringRuleResponseDtoV2[], required
    - `id` string, required — Auto-generated ID for the filtering rule
    - `name` string, required — Name of the filtering rule
    - `environment` string, required — Environment ID the rule belongs to
    - `expression` string, required — Expression in expr-lang format that defines the rule condition
    - `action` 'allow' | 'deny', required — Action to take when the rule matches
    - `status` 'enabled' | 'disabled', required — Status of the filtering rule
    - `deny_with` string, nullable — Error message to return when denying a request
    - `created_at` string, date-time, required — Date when the rule was created
    - `updated_at` string, date-time, nullable — Date when the rule was last updated

## Other responses

- `400` — Error: Bad request.
- `401` — Error: Invalid API key.
- `403` — Forbidden. Insufficient permissions.
- `422` — Error: Payload parameters are invalid.
- `429` — Error: API key has exceeded its rate limit.

---

[API](https://skmtc.dev/fingerprint/apis/management-api.md) · [All operations](https://skmtc.dev/fingerprint/apis/management-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/fingerprint/management-api/revisions/b17eccec9d47/schema)